Branch was auto-updated.

detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml

@@ -0,0 +1,62 @@
+name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
+id: 114c6bfe-9406-11ec-bcce-acde48001122
+version: 1
+date: '2022-02-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser`
+  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
+  As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser 
+  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+references:
+- https://attack.mitre.org/techniques/T1558/004/
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 60
+  confidence: 90 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$

detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml

@@ -0,0 +1,58 @@
+name: Disabled Kerberos Pre-Authentication Discovery With PowerView
+id: b0b34e2c-90de-11ec-baeb-acde48001122
+version: 1
+date: '2022-02-18'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser`
+  is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks.
+  As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired`
+  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use PowerView for troubleshooting
+references:
+- https://attack.mitre.org/techniques/T1558/004/
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 60
+  confidence: 90 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -1,26 +1,30 @@
 name: Kerberoasting spn request with RC4 encryption
 id: 5cc67381-44fa-4111-8a37-7a230943f027
-version: 3
-date: '2020-10-16'
-author: Jose Hernandez, Patrick Bareiss, Splunk
+version: 4
+date: '2022-02-09'
+author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: This search detects a potential kerberoasting attack via service principal
-  name requests
-search: '`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17
+description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
+ against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
+ attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field
+ based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
+search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
   Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `kerberoasting_spn_request_with_rc4_encryption_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  and include the windows security event logs that contain kerberos
-known_false_positives: Older systems that support kerberos RC4 by default NetApp may
-  generate false positives
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: Older systems that support kerberos RC4 by default like NetApp may
+  generate false positives. Filter as needed
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md
 - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Active Directory Kerberos Attacks
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
@@ -31,15 +35,15 @@ tags:
   - Source:Endpoint
   - Stage:Credential Access
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
   impact: 90
   kill_chain_phases:
   - Privilege Escalation
   message: Potential kerberoasting attack via service principal name requests detected
     on $dest$
   mitre_attack_id:
-  - T1558.003
   - T1558
+  - T1558.003
   nist:
   - DE.CM
   observable:

detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

@@ -0,0 +1,59 @@
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
+id: 0cb847ee-9423-11ec-b2df-acde48001122
+version: 1
+date: '2022-02-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security Event 4738, `A user account was changed`,
+  to identify a change performed on a domain user object that disables Kerberos Pre-Authentication.
+  Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute
+  force attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
+  or a way to escalate privileges.
+search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*"
+| table EventCode, Account_Name, Security_ID, MSADChangedAttributes
+| `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events. The Advanced Security Audit policy setting
+  `User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Unknown.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+  kill_chain_phases:
+  - Intrusion
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Account_Name
+  - Security_ID
+  - MSADChangedAttributes
+  security_domain: endpoint
+  impact: 50
+  confidence: 90 
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
+  message: Kerberos Pre Authentication was Disabled for $Account_Name$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml

@@ -0,0 +1,57 @@
+name: Kerberos Pre-Authentication Flag Disabled with PowerShell
+id: 59b51620-94c9-11ec-b3d5-acde48001122
+version: 1
+date: '2022-02-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl`
+  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
+  As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account.
+  With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to
+  to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
+  or a way to escalate privileges.
+search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
+  kill_chain_phases:
+  - Intrusion
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 90 
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
+  message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -0,0 +1,70 @@
+name: Mimikatz PassTheTicket CommandLine Parameters
+id: 13bbd574-83ac-11ec-99d4-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. 
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" 
+  OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+references:
+- https://github.com/gentilkiwi/mimikatz
+- https://attack.mitre.org/techniques/T1550/003/  
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/rubeus_command_line_parameters.yml

@@ -0,0 +1,78 @@
+name: Rubeus Command Line Parameters
+id: cca37478-8377-11ec-b59a-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs 
+  MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets,
+  forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks.
+  Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" 
+  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" 
+  OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" 
+  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*"
+  OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+references:
+- https://github.com/GhostPack/Rubeus 
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ 
+- https://attack.mitre.org/techniques/T1550/003/ 
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550
+  - T1550.003
+  - T1558
+  - T1558.003
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Rubeus command line parameters were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process

detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml

@@ -0,0 +1,71 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+id: 5ed8c50a-8869-11ec-876f-acde48001122
+version: 1
+date: '2022-02-07'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior
+  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by
+  obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks.
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
+search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
+  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND 
+  SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND
+  SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
+  SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
+  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
+how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
+  includes EventCode 10. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment.
+known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
+references:
+- https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1550
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Winlogon.exe was accessed by $SourceImage$ on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: TargetImage
+    type: Process
+    role:
+    - Target

detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml

@@ -48,6 +48,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml

@@ -56,6 +56,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -66,6 +67,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Privilege Escalation
+  - Active Directory Kerberos Attacks
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:

detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml

@@ -0,0 +1,68 @@
+name: Unusual Number of Kerberos Service Tickets Requested
+id: eb3e6702-8936-11ec-98fe-acde48001122
+version: 1
+date: '2022-02-08'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+datamodel: []
+description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
+ against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
+ attempt to crack them offline allowing them to obtain privileged access to the domain.\
+ 
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
+ analytic, users can try different combinations of the `bucket` span time and the
+ calculation of the `upperBound` field. 
+search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17
+| bucket span=2m _time
+| stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address
+| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by Client_Address
+| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
+| search isOutlier=1
+| `unusual_number_of_kerberos_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of kerberos service
+  tickets is not common behavior. Possible false positive scenarios include but are
+  not limited to vulnerability scanners, administration systems and missconfigured
+  systems.
+references:
+- https://attack.mitre.org/techniques/T1558/003/
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting 
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - Service_Name
+  - service_id
+  - Client_Address
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: 
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim

stories/active_directory_kerberos_attacks.yml

@@ -0,0 +1,34 @@
+name: Active Directory Kerberos Attacks
+id: 38b8cf16-8461-11ec-ade1-acde48001122
+version: 1
+date: '2022-02-02'
+author: Mauricio Velazco, Splunk
+description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
+narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and
+ users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access
+ to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since
+ the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases 
+ of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\
+ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in 
+ Kerberos based attacks.
+references:
+- https://en.wikipedia.org/wiki/Kerberos_(protocol)
+- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+- https://attack.mitre.org/techniques/T1558/003/
+- https://attack.mitre.org/techniques/T1550/003/
+- https://attack.mitre.org/techniques/T1558/004/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Lateral Movement
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml

@@ -0,0 +1,15 @@
+name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser Unit Test
+tests:
+- name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
+  file: endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
+
+
+

tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml

@@ -0,0 +1,12 @@
+name: Disabled Kerberos Pre-Authentication Discovery With PowerView Unit Test
+tests:
+- name: Disabled Kerberos Pre-Authentication Discovery With PowerView
+  file: endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml

@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: True

tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml

@@ -0,0 +1,13 @@
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl Unit Test
+tests:
+- name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
+  file: endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True

tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml

@@ -0,0 +1,13 @@
+name: Kerberos Pre-Authentication Flag Disabled with PowerShell Unit Test
+tests:
+- name: Kerberos Pre-Authentication Flag Disabled with PowerShell
+  file: endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
+    update_timestamp: True

tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Mimikatz PassTheTicket CommandLine Parameters Unit Test
+tests:
+- name: Mimikatz PassTheTicket CommandLine Parameters
+  file: endpoint/mimikatz_passtheticket_commandline_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rubeus_command_line_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Rubeus Command Line Parameters Unit Test
+tests:
+- name: Rubeus Command Line Parameters
+  file: endpoint/rubeus_command_line_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml

@@ -0,0 +1,12 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access Unit Test
+tests:
+- name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+  file: endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml

@@ -0,0 +1,12 @@
+name: Unusual Number of Kerberos Service Tickets Requested Unit Test
+tests:
+- name: Unusual Number of Kerberos Service Tickets Requested
+  file: endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog